Effective August 1, 2026
Information we collect
Private accounts sign in with an email address or phone number and a password. Contact identifiers are encrypted at rest for account lookup; the service holds the contact-storage key. Passwords are not sent or stored: your device derives authentication and encryption keys using a password-strengthening function and a random account salt. Display names and usernames are public and readable by the server, appearing in profiles, exact ID/username search, contacts and conversations. Updated clients publish an existing account's saved display name when opening its session. Bios, photos, contacts, personal nicknames, conversation labels, invitation history, and preferences are encrypted before they are synced as a private vault. Account IDs are randomly assigned. We still process public verification keys, opaque account and conversation identifiers, delivery membership, push tokens, call signaling, and technical records needed to operate the service.
How we use information
We use information to authenticate accounts, deliver conversations and calls, send notifications, display link previews, prevent abuse, respond to support requests, maintain service reliability, and comply with law. We do not sell personal information or use message content for advertising.
The public invitation map shows actual invitation relationships and the last four characters of user IDs, using shuffled temporary node identifiers rather than full account IDs or private profiles. It also displays recent incoming/outgoing encrypted-payload size estimates and timing. These public activity signals can permit correlation; message contents and recipient pairs are not shown. Chart samples are held in bounded server-worker memory for up to 10 seconds, not saved as chart history. The server records invitation issuer/redemption relationships; personal invitation-management history remains in the encrypted owner vault.
Message privacy
Private and group messages, attachments, edits, deletions, and reactions are end-to-end encrypted on participating devices. The server holds ciphertext until every device addressed at send time confirms local storage, then removes the live queued payload. Offline devices can keep ciphertext queued indefinitely. The server retains public verification and device keys, opaque account identifiers, conversation membership, and delivery metadata. Encryption of personal information does not hide all routing relationships, IP addresses, or traffic timing. Production transport uses HTTPS and secure WebSocket connections.
Device keys use first-observed-key trust. Compare device safety codes through another trusted channel: unverified first-contact keys and newly registered devices are not protected against a malicious directory. This protocol does not provide forward secrecy or independent security certification. Device or website compromise, recipient sharing, legal requests for retained information, and network blocking are outside its protection.
Sharing and processors
Information may be processed by infrastructure, database, storage, notification, authentication, and monitoring providers acting on our behalf. We may disclose information when required by law, to protect users, or during a business transfer subject to appropriate safeguards.
Retention and deletion
Private-account history, attachments, and browser device identities are encrypted locally. To keep you signed in across restarts, the derived account key and session persist in browser local storage; native derived material uses operating-system secure storage. Your password is not saved. Anyone with access to the browser profile or compromised same-origin code may use its saved key to open the account. Sign out on shared devices. Sign-in lasts until logout, local data removal, account deletion, or an application reset; temporary network failures do not erase saved credentials. Native audio/video playback and explicit sharing can create temporary decrypted files, which are removed on account lock; a crash or operating-system copy can leave temporary data. Private-account archive exports are encrypted. Signing in restores the private vault, not history already flushed from the relay or another device's message keys. Phase one does not provide email/SMS password reset or a recovery phrase. Forgotten credentials can prevent vault recovery. Android app backup is disabled. Removing live records does not guarantee forensic erasure from journals, logs, or infrastructure backups. Reports intentionally disclose the chosen category and opaque account/message identifiers to the operator, without automatically including decrypted messages or profiles.
Your choices
You can update profile information, control notifications and device permissions, block users, report content, and delete your account in the app. Requests concerning access, correction, or privacy can be sent to privacy@looptalk.app.
Children and changes
LoopTalk is not directed to children under 13, or the higher minimum age required in their country. We may update this policy and will publish the effective date here. Material changes will be communicated through the service where appropriate.